Securing The Kernel via Static Binary Rewriting and Program Shepherding